Security Awareness Training FAQ
Answers to the questions admins ask most about Security Awareness Training, including access, setup, scenarios, delivery and how long data is kept. For an overview of how the feature works, see Security Awareness Training.
Who can see Security Awareness Training?
Only admins on your Paubox account can see it. Other users don’t see it in the dashboard. Security Awareness Training isn’t available for partner or partner client accounts.
How do I turn Security Awareness Training on or off?
Paubox turns it on and off for you. It’s an add-on for Paubox Email Suite Plus and above. Contact us to add it, or to ask about turning it off.
If you’re turning it off, first cancel any campaigns that are still In progress. See Review campaign results and export the report. Your past results are kept if it’s turned on again later.
Can we write our own phishing scenario?
No. You can choose from six built-in scenarios: Microsoft login reset, DocuSign notification, Fax received, Secure message notification, HR benefits update and Package delivery. Generate AI variation writes a new version of the email for the scenario you pick, but you can’t add a new scenario or edit the email.
Can we set a difficulty level or target a department?
No. Campaigns go to All users or to specific people you choose.
Do you offer training videos or courses?
No. The training is the simulation itself, plus the page employees see when they enter information on the fake sign-in page. That page explains the warning signs they missed. See What your employees see when they click a simulation.
If an employee types their password into the fake sign-in page, does Paubox keep it?
No. Paubox records only which fields were filled in, never what was typed.
Our simulations never arrive. Why?
Check Mailbox Access first. Go to Settings > Account and make sure the Mailbox Access card says Connected. Without Mailbox Access, simulations are delivered as ordinary email and your provider’s spam filter may catch them.
If you use Google Workspace, also make sure an Admin email is saved on the card. See Getting started with Security Awareness Training: connect Mailbox Access first.
Does Security Awareness Training track employees who report the simulation?
No. Reporting a simulation as phishing isn’t recorded.
How long is Security Awareness Training data kept?
Detailed tracking data, such as who each simulation was sent to and who opened or clicked it, is kept for two years. Your campaigns stay in your list after that. The Security Awareness Training audit log is kept for six years. If you need detailed results for longer, export each campaign’s report.